In the art of routing digital data through data-packet networks, research and development of methods for more efficient handling of data packets continues. Generally speaking, a data packet is a digitized and organized block of binary data that is a “packaged” portion of a specific communication or data transfer from a source location to an ultimate destination on a network. A data packet typically has a header, and a data body. The packet header is used for data routing through the network. During routing from a source location to a routed destination, data packets may be processed at one or more stops or routing points along the way. These hops, as they are often termed, are between data routers and, in some cases, server nodes distributed through the network. Common types of data packets routed, for example, over the Internet network and most commonly dealt with in data routing include transfer control protocol (TCP) packets and Internet protocol (IP) data packets.
Among TCP packets there are packets carrying data and also others carrying other information such as error messages, and control messages. Some TCP packets are generated by routers and communicated to other routers, as well as generated by routers and communicated to source/destination locations other than routers. TCP communication is a substantial part of all network communication or load.
It will be appreciated by the skilled artisan that many TCP and IP data packets comprising router-to-router communications and internal router communications are generated in the network and are destined for a central processing unit adapted to process them. For example, router-to-router communications, such as request and response messages related to routing are prevalent. Error packets related to control errors and the like are also prevalent.
Prior-art data routers typically utilize a central processing unit (CPU), which is separate from the router's data packet processor or processors in order to process error messages, control messages, and data packets that for some reason require special handling. A network access controller (NAC) is (typically) hardware that reads and routes CPU-destined data packets to the router CPU for processing.
In some instances, CPU-destined data packets are corrupted packets or damaged packets. Still other CPU-destined packets are addressed to the router by another router or computer. In some cases these are fraudulent data packets purposely and repeatedly generated and sent to a network destination (CPU) with the mission being to compromise the CPU of the destination machine. Computer network hackers, working alone or in conjunction with others have been known to launch such attacks, wherein an overload of erroneous data is generated and routed to a single point in the network for processing, causing that point to fail from CPU overload. One common form of attack is known in the art as a denial-of-service (DOS) attack wherein repeated requests are sent to one network location, causing the location to overload while processing and responding to all of the requests.
A problem with prior art CPU handling of data packets is that the CPU has no means of determining priority in packet handling. For example, all packets directed thereto by a NAC are processed on a first-come, first-processed basis. There is no method of sorting good packets from bad packets or sorting packets by the type of request they carry. This problem has led to occurrences of failure for routers and, in many cases, loss of traffic to network servers connected in their paths. In some cases servers themselves are targeted. In the case of an attack on a router, the affected router may fail or become compromised as the CPU works in overload conditions to process all of the erroneous or spurious data sent. Moreover, a server connected to that router may suffer lack of data traffic due to failure of the router in front of it.
What is clearly needed is a method and apparatus that enables a router or server to quickly identify and sort data packets that require special handling by category and priority so that the CPU is able to adequately process legitimate and useful packets, even in the presence of an overload of erroneous or spurious packets.